CVE-2026-117602

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-117602", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-27T13:04:09.906Z", "datePublished": "2026-10-27T13:09:52.040Z", "dateUpdated": "2026-11-05T16:59:57.475Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-27T13:09:52.040Z"}, "datePublic": "2026-04-28T00:00:00.000Z", "title": "Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution", "descriptions": [{"lang": "en", "value": "Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Verification of Cryptographic Signature", "cweId": "CWE-347", "type": "CWE"}]}], "affected": [{"vendor": "spesmilo", "product": "electrum", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "4.7.2"}, {"version": "4.7.2", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:electrum:electrum:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.7.2"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 8.6, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qf", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-vw94-r84p-66qf)"}, {"url": "https://github.com/spesmilo/electrum/commit/032dfcf107da1d31bbee5d64ca978e554fd8e982", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/spesmilo/electrum/commit/fd7164d6dc1560b6f153c018cabf17e9411c5414", "tags": ["patch"], "name": "Patch Commit"}, {"name": "VulnCheck Advisory: Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/electrum-before-4.7.2-external-plugin-authorization-bypass-local-code-execution"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T16:59:46.042592Z", "id": "CVE-2026-117602", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T16:59:57.475Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-117602", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T16:59:46.042592Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T16:59:51.739Z"}}], "cna": {"title": "Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution", "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "spesmilo", "product": "electrum", "versions": [{"status": "affected", "version": "0", "lessThan": "4.7.2", "versionType": "semver"}, {"status": "unaffected", "version": "4.7.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-04-28T00:00:00.000Z", "references": [{"url": "https://github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qf", "name": "GitHub Security Advisory (GHSA-vw94-r84p-66qf)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/spesmilo/electrum/commit/032dfcf107da1d31bbee5d64ca978e554fd8e982", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/spesmilo/electrum/commit/fd7164d6dc1560b6f153c018cabf17e9411c5414", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/electrum-before-4.7.2-external-plugin-authorization-bypass-local-code-execution", "name": "VulnCheck Advisory: Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "Improper Verification of Cryptographic Signature"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:electrum:electrum:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.7.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-27T13:09:52.040Z"}}}, "cveMetadata": {"cveId": "CVE-2026-117602", "state": "PUBLISHED", "dateUpdated": "2026-11-05T16:59:57.475Z", "dateReserved": "2026-10-27T13:04:09.906Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-27T13:09:52.040Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "electrum", "vendor": "spesmilo", "versions": [{"lessThan": "4.7.2", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "4.7.2", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process."}], "id": "CVE-2026-117602", "lastModified": "2026-11-05T17:17:44.587", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-117602", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T16:59:46.042592Z", "version": "2.0.3"}}]}, "published": "2026-10-27T14:16:40.090", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/spesmilo/electrum/commit/032dfcf107da1d31bbee5d64ca978e554fd8e982"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/spesmilo/electrum/commit/fd7164d6dc1560b6f153c018cabf17e9411c5414"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qf"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/electrum-before-4.7.2-external-plugin-authorization-bypass-local-code-execution"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "electrum: Electrum: Arbitrary code execution via external plugin authorization bypass", "id": "2561980", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561980"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-347", "details": ["Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process.", "A flaw was found in Electrum. The external plugin loader does not verify authorization signatures before executing enabled plugins. A local attacker with write access to the application data directory can place malicious plugin code into the plugins folder and enable it in the configuration file. This flaw allows the attacker to achieve arbitrary code execution within the running Electrum process."], "name": "CVE-2026-117602", "public_date": "2026-10-27T13:09:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-117602\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-117602\nhttps://github.com/spesmilo/electrum/commit/032dfcf107da1d31bbee5d64ca978e554fd8e982\nhttps://github.com/spesmilo/electrum/commit/fd7164d6dc1560b6f153c018cabf17e9411c5414\nhttps://github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qf\nhttps://www.vulncheck.com/advisories/electrum-before-4.7.2-external-plugin-authorization-bypass-local-code-execution"], "statement": "This vulnerability is rated as Important because local unauthorized code execution within the user's running application context could compromise sensitive wallet data without requiring elevated system privileges. While exploitation requires existing write permissions to the application's configuration storage, the failure to enforce cryptographic verification allows an unprivileged local attacker or process to completely take over the application environment. Electrum is not distributed or supported within Red Hat Enterprise Linux, limiting exposure strictly to users of Fedora community packages.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.7.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "4.7.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "electrum", "source": "cna", "vendor": "spesmilo"}, "product": "electrum", "vendor": "electrum"}], "created": "2026-10-27T14:45:03.609782+00:00", "updated": "2026-10-27T20:30:08.574661+00:00", "vendors": ["electrum", "electrum$PRODUCT$electrum"]}